From de4a65a9590b1cd1d59898ed280b106d90d9e9c3 Mon Sep 17 00:00:00 2001 From: Crimson Date: Fri, 8 May 2026 10:34:19 +0500 Subject: [PATCH] =?UTF-8?q?=D0=94=D0=BE=D0=B1=D0=B0=D0=B2=D0=B8=D0=BB=20po?= =?UTF-8?q?licy=20HY2XS=5FDNS=5FAAAA=5FPOLICY=20=D0=B8=20=D1=83=D0=BF?= =?UTF-8?q?=D1=80=D0=B0=D0=B2=D0=BB=D1=8F=D0=B5=D0=BC=D0=BE=D0=B5=20AAAA-?= =?UTF-8?q?=D0=BF=D0=BE=D0=B2=D0=B5=D0=B4=D0=B5=D0=BD=D0=B8=D0=B5=20=D0=B2?= =?UTF-8?q?=20preflight?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- docs/12-operations-and-troubleshooting.md | 8 ++++++++ docs/13-production-runbook.md | 4 ++++ orchestrator/src/config/env.ts | 11 +++++++++++ orchestrator/src/steps/preflight.ts | 13 ++++++++++--- orchestrator/src/types/context.ts | 3 +++ package/config/hy2xs.env | 1 + 6 files changed, 37 insertions(+), 3 deletions(-) diff --git a/docs/12-operations-and-troubleshooting.md b/docs/12-operations-and-troubleshooting.md index 22e353e..66e4ecf 100644 --- a/docs/12-operations-and-troubleshooting.md +++ b/docs/12-operations-and-troubleshooting.md @@ -120,6 +120,14 @@ curl -sS \ - auth material - что используется совместимый клиентский конфиг +### Install/reconfigure падает на DNS AAAA +Проверить значение `HY2XS_DNS_AAAA_POLICY` в `/etc/hy2xs/hy2xs.env`: +- `strict` (default): AAAA приводит к fail в IPv4-only профиле; +- `warn`: warning + продолжение; +- `off`: AAAA-check отключён. + +Для production baseline рекомендуется `strict`. + ### Скорость не соответствует ожиданиям Проверить: - `bandwidth.*` на сервере diff --git a/docs/13-production-runbook.md b/docs/13-production-runbook.md index 00a2919..feb4a9d 100644 --- a/docs/13-production-runbook.md +++ b/docs/13-production-runbook.md @@ -82,6 +82,10 @@ hy2xs-orchestrator reconfigure --package-dir /usr/local/lib/hy2xs/package --conf - HY2XS работает в IPv4-only режиме. - если IPv6 включён на хосте/провайдере — это вне baseline и должно быть отдельно управляемо оператором. +- `HY2XS_DNS_AAAA_POLICY` управляет реакцией preflight на DNS AAAA: + - `strict` (default) — install/reconfigure прекращается при наличии AAAA; + - `warn` — выводится warning и выполнение продолжается; + - `off` — AAAA-проверка игнорируется. ## 12. Validation command diff --git a/orchestrator/src/config/env.ts b/orchestrator/src/config/env.ts index b0828f2..2392753 100644 --- a/orchestrator/src/config/env.ts +++ b/orchestrator/src/config/env.ts @@ -127,6 +127,14 @@ function normalizeAcmeType(value: string): "http" | "tls" | "dns" { throw new Error(`invalid HY2XS_ACME_TYPE: ${value}`); } +function normalizeDnsAaaaPolicy(value: string | undefined): "strict" | "warn" | "off" { + const policy = value || "strict"; + if (policy === "strict" || policy === "warn" || policy === "off") { + return policy; + } + throw new Error(`invalid HY2XS_DNS_AAAA_POLICY: ${value}`); +} + function normalizeFixedHysteriaAuthMode(value: string | undefined): "http" { const mode = value || "http"; if (mode !== "http") { @@ -180,12 +188,14 @@ export function parseRuntimeEnv(content: string): RuntimeConfig { const trafficStatsPort = parsePort("HY2XS_HYSTERIA_TRAFFIC_STATS_PORT", env.HY2XS_HYSTERIA_TRAFFIC_STATS_PORT, 36712); const tlsMode = normalizeTlsMode(env.HY2XS_TLS_MODE || "acme"); const acmeType = normalizeAcmeType(env.HY2XS_ACME_TYPE || "http"); + const dnsAaaaPolicy = normalizeDnsAaaaPolicy(env.HY2XS_DNS_AAAA_POLICY); const firewallMode = normalizeFirewallMode(env); const hysteriaAuthMode = normalizeFixedHysteriaAuthMode(env.HY2XS_HYSTERIA_AUTH_MODE); const hysteriaObfsType = normalizeFixedHysteriaObfsType(env.HY2XS_HYSTERIA_OBFS_TYPE); const config: RuntimeConfig = { domain: env.HY2XS_DOMAIN || "", + dnsAaaaPolicy, publicHost: normalizePublicHost(env.HY2XS_PUBLIC_HOST || env.HY2XS_DOMAIN || ""), publicPort: parsePort("HY2XS_PUBLIC_PORT", env.HY2XS_PUBLIC_PORT, hysteriaPort), ipv6Enabled: parseBool("HY2XS_IPV6_ENABLED", env.HY2XS_IPV6_ENABLED, false), @@ -289,6 +299,7 @@ export function renderRuntimeEnv(config: RuntimeConfig): string { "# HY2XS runtime config (editable)", "HY2XS_IPV6_ENABLED=false", `HY2XS_DOMAIN=${config.domain}`, + `HY2XS_DNS_AAAA_POLICY=${config.dnsAaaaPolicy}`, `HY2XS_PUBLIC_HOST=${config.publicHost}`, `HY2XS_PUBLIC_PORT=${config.publicPort}`, `HY2XS_SSH_PORT=${config.sshPort}`, diff --git a/orchestrator/src/steps/preflight.ts b/orchestrator/src/steps/preflight.ts index 7fa8f22..e7aeefe 100644 --- a/orchestrator/src/steps/preflight.ts +++ b/orchestrator/src/steps/preflight.ts @@ -143,9 +143,16 @@ export async function preflight(context: RuntimeContext): Promise { } } if (aaaa.length > 0) { - fail( - `domain ${context.config.domain} has DNS AAAA record while HY2XS profile is IPv4-only; remove AAAA record before install` - ); + if (context.config.dnsAaaaPolicy === "strict") { + fail( + `domain ${context.config.domain} has DNS AAAA record while HY2XS profile is IPv4-only; remove AAAA record before install` + ); + } + if (context.config.dnsAaaaPolicy === "warn") { + info( + `warning: domain ${context.config.domain} has DNS AAAA record while HY2XS profile is IPv4-only; continuing due to HY2XS_DNS_AAAA_POLICY=warn` + ); + } } } diff --git a/orchestrator/src/types/context.ts b/orchestrator/src/types/context.ts index d7e908f..b8df827 100644 --- a/orchestrator/src/types/context.ts +++ b/orchestrator/src/types/context.ts @@ -22,8 +22,11 @@ export type RunMode = "install" | "reconfigure"; export type TlsMode = "acme" | "file" | "self_signed_dev"; +export type DnsAaaaPolicy = "strict" | "warn" | "off"; + export type RuntimeConfig = { domain: string; + dnsAaaaPolicy: DnsAaaaPolicy; publicHost: string; publicPort: number; ipv6Enabled: boolean; diff --git a/package/config/hy2xs.env b/package/config/hy2xs.env index 3fd0f8c..f22dc44 100644 --- a/package/config/hy2xs.env +++ b/package/config/hy2xs.env @@ -1,6 +1,7 @@ # HY2XS canonical production runtime config (packaged baseline) HY2XS_IPV6_ENABLED=false HY2XS_DOMAIN=uk.api.withen.pro +HY2XS_DNS_AAAA_POLICY=strict HY2XS_PUBLIC_HOST=uk.api.withen.pro HY2XS_PUBLIC_PORT=443 HY2XS_SSH_PORT=22